US7069588B2 - System and method for protecting computer device against overload via network attack - Google Patents
System and method for protecting computer device against overload via network attack Download PDFInfo
- Publication number
- US7069588B2 US7069588B2 US09/941,981 US94198101A US7069588B2 US 7069588 B2 US7069588 B2 US 7069588B2 US 94198101 A US94198101 A US 94198101A US 7069588 B2 US7069588 B2 US 7069588B2
- Authority
- US
- United States
- Prior art keywords
- cache
- memory
- session
- entries
- class
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Lifetime, expires
Links
- 238000000034 method Methods 0.000 title claims description 34
- 238000013138 pruning Methods 0.000 claims abstract description 31
- 238000012545 processing Methods 0.000 claims abstract description 14
- 238000004891 communication Methods 0.000 claims abstract description 11
- 230000007246 mechanism Effects 0.000 claims abstract description 10
- 238000012217 deletion Methods 0.000 claims description 21
- 230000037430 deletion Effects 0.000 claims description 21
- 230000000116 mitigating effect Effects 0.000 claims 2
- 244000141353 Prunus domestica Species 0.000 abstract description 8
- 230000002459 sustained effect Effects 0.000 abstract description 2
- 230000008569 process Effects 0.000 description 16
- 239000011449 brick Substances 0.000 description 6
- 238000010586 diagram Methods 0.000 description 5
- 230000006870 function Effects 0.000 description 5
- 230000009471 action Effects 0.000 description 3
- 230000003466 anti-cipated effect Effects 0.000 description 3
- 238000012544 monitoring process Methods 0.000 description 3
- 238000012360 testing method Methods 0.000 description 3
- 230000001010 compromised effect Effects 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000008901 benefit Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 230000015556 catabolic process Effects 0.000 description 1
- 238000006731 degradation reaction Methods 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 238000009432 framing Methods 0.000 description 1
- 230000001939 inductive effect Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000010926 purge Methods 0.000 description 1
- 230000001052 transient effect Effects 0.000 description 1
- 230000007704 transition Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/02—Standardisation; Integration
- H04L41/0213—Standardised network management protocols, e.g. simple network management protocol [SNMP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1458—Denial of Service
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
Definitions
- the present invention relates generally to the field of Computer Network Security.
- connection When two devices on a computer network communicate with each other, they typically do so by creating a connection between them. That connection is identified by the protocol used for communication, and the addresses and ports used by each endpoint. Once a connection has been established, the two endpoints may exchange many data packets. The connection and the packets that are sent in that connection are referred to as a “session.”
- Some devices for example, simple routers that process traffic on computer networks make packet-by-packet decisions about how to handle network traffic. A set of rules is applied to each packet received by the device, and the packet is then handled accordingly. The rules are applied without regard to what other packets within a session may previously have been processed. Such devices are called “non-stateful” devices, because they handle traffic without regard to the state of the session.
- So-called “stateful” devices operate under the assumption that there will be many packets for each session. They maintain state information about the sessions that they process, thus allowing traffic in established sessions to be processed quickly.
- Maintaining state information requires that stateful device allocate resources dedicated to storing that information.
- One form of attack against a stateful device involves creating false sessions, and by doing so inducing that device to maintain information about those sessions, to the extent that the device no longer has enough resources to process legitimate network traffic.
- a stateful device that is aware of the semantics of connection-oriented services, like TCP (transmission control protocol), makes a decision at connection setup time, and then forwards messages more efficiently for subsequent packets in that connection. Finally, when the service semantics indicate that the session is complete, the device stops forwarding packets for that session.
- TCP transmission control protocol
- a device can support 10,000 simultaneous sessions.
- the smallest size of an IP packet containing a UDP segment is 32 bytes or 256 bits (ignoring L 2 framing).
- a potential attacker could generate 10,000 unique sessions in about 45 seconds.
- Over a T-1 connection 1.544 Mbps
- this same attack would take less than 2 seconds. This action would completely shut down the device until it could remove these sessions from its list of active sessions (usually by idle timeout or other cleanup mechanism).
- the simplest action to take when all available cache memory is used is to ignore new sessions.
- the difficulty with that strategy is that while it allows existing users to continue working, it prevents new users from accessing protected resources (servers, etc.).
- a different strategy is to simply clear existing sessions from the device's memory, and place new sessions in the newly-freed space. That strategy has the drawback that removing existing sessions arbitrarily may interrupt the flow of traffic for valid sessions. It may not be possible to resume or recover those sessions easily (for example, an FTP download that has been running for thirty minutes might have to be started all over again). Thus, it is desirable to have a more efficient methodology to determine which sessions are expendable.
- the present invention protects network devices from network packet flood attacks that would otherwise consume available resources, and possibly cause system failure or compromise the system by allowing intrusion.
- the invention termed an “intelligent cache management system,” is used to free allocated resources (memory, in particular) for reuse when a device is under sustained attack.
- One exemplary embodiment of an intelligent cache management system of the present invention is used in connection with session-type packet processing devices of a computer network.
- the system comprises a memory management database for storing communication traffic classification and memory threshold values, and a memory monitor for tracking overall memory usage and determining when the memory threshold values stored in the memory management database are reached.
- a cache classifier is used to determine a class into which a given session of communications traffic falls.
- a pruning mechanism selects and prunes session cache entries on the packet processing device according to the traffic classification and memory thresholds programmed in the memory management database.
- FIG. 1 is an illustration of memory versus time for an exemplary system configured using the cache management system of the present invention
- FIG. 2 is an illustration of cache classes and exemplary configurable thresholds for an exemplary cache management system of the present invention
- FIG. 3 is an exemplary flow diagram for the memory monitoring process according to the present invention.
- FIG. 4 is an exemplary flow diagram for the pruning process according to the present invention.
- FIG. 5 is an exemplary functional block diagram for a cache management system of the present invention.
- An exemplary firewall of the type in which the present invention may be implemented contains a cache of all currently-active sessions in a large block of RAM. This cache is tracked by unique identifiers for each session, including source and destination addresses and source and destination ports. Any session processed by the firewall, regardless of whether it is passed or dropped, is entered into that cache, for performance reasons.
- a new packet arrives at the firewall, it is compared against the existing session cache entries to see whether there exists a cache entry matching that packet. If so, the packet is immediately processed (passed, dropped, and so forth) as indicated in the session cache entry. That processing can be done very efficiently, providing an extremely low-latency path through the firewall. If no matching cache entry exists, the packet is processed by sequentially comparing it to rules in each of several zones, for example, (possibly generating a cache entry for each zone) to determine what should be done with it.
- the present invention is an intelligent cache management system, and related methodology, for a firewall-type device which acts to “prune” sessions from a session cache, when necessary, in a manner that will have the least possible impact on end users.
- the present invention is advantageous in that it activates the pruning mechanism only when it is reasonable to conclude that an attack is in progress. That is done by allowing a firewall administrator to configure the system so that it begins to prune sessions only when the cache memory used exceeds an anticipated level.
- the level called a “global ceiling value” represents a percentage of total cache memory; it indicates the point at which the feature should activate.
- An exemplary default value is 85%.
- the invention is also advantageous in that it limits how much memory the pruning mechanism will free, thus ensuring that sufficient resources will be freed while also limiting the number of session cache entries that will be discarded. That is accomplished by allowing the administrator to set a global floor value, representing a percentage of total cache memory on the firewall.
- the floor value indicates the desired amount cache memory that should remain in use after the feature executes.
- An exemplary default value is 60%.
- the invention is also advantageous in that it provides the ability to apply protection where it is most likely to be needed. This is done by allowing the administrator to identify anticipated usage levels for particular classes of traffic, and by first pruning cache entries for those classes when they have exceeded the anticipated thresholds. Thus, the session cache entries targeted for pruning are those most likely to represent sessions created by an attacker.
- the invention is also advantageous in that it provides the ability to prioritize certain types of traffic for pruning, thereby allowing pruning to proceed in the least disruptive way possible in the event that the pruning mechanism must discard cache entries for sessions that are not likely to be part of an attack. This is done by allowing the administrator to place the defined classes of traffic in a priority order. The classes at the top of the list will be considered first for pruning.
- the invention is also advantageous in that it provides for the deletion of a fractional number of cache entries from a given class without requiring the use of floating-point operations in the computation and tracking of those fractions.
- the classes of traffic are defined using certain criteria, for example, as follows: auditing level applied to the session (Any, None, Basic, or Detailed); action criteria (Any, Pass, Drop, Proxy, or VPN); service criteria (Any, or a combination of protocol and ports); and whether the session is a half-open TCP session.
- Each one of these criteria may be assigned a given a percentage, for example, which defines a threshold amount of “expected” traffic of this type at any point in time. It should be noted that the relative order of these five traffic classes is adjustable.
- the basic operation of the cache management system of the present invention also termed the Intelligent Cache Management (ICM) system is as follows (referring to FIG. 1 , a chart 100 of in-use memory vs. time is shown for an exemplary cache management system): As shown, the system is configured with threshold floor and ceiling thresholds of 30 percent and 85 percent available memory of the system. Once the global memory usage exceeds the ceiling, sessions are selected for pruning from the cache. Sessions are then pruned until either the floor is reached, or all sessions in the configured cache classes have been pruned. Once sessions have been identified for pruning, the brick processes its list of session cache entries and removes entries accordingly. Since it has already been determined which entries are to be discarded and which are not, only one pass through the list of cache entries is required.
- ICM Intelligent Cache Management
- the effect of pruning a session is fairly minimal to the user. This is because the session is simply removed from the firewall's memory, where the session can be reestablished if new traffic is sent by the original source. Also note that fully-open TCP connections are never pruned, thereby eliminating the possibility of disturbing a valid, established TCP session.
- FIG. 1 illustrates a system that has been configured to have a ceiling of 85% and a floor of 30%. The flood executes until the system reaches the ceiling, and then the ICM feature becomes active. Once ICM executes, it must examine each cache class to see which, if any, classes are above the configured thresholds.
- a bar graph 200 of exemplary cache classes for the system of FIG. 1 is shown.
- Dropped and Half-Open classes 202 , 204 are above their own thresholds.
- the ICM invention will first consider pruning Dropped and Half-Open sessions to get to the desired floor value. If the ICM determines that even by pruning all above-threshold sessions, the desired floor can't be achieved, it will prune all of the above-threshold sessions, and selectively prune the remaining cache class sessions to achieve the floor.
- FIG. 3 shows the basic methodology used by the ICM to monitor cache memory usage (step 300 ).
- the system checks whether the overall memory usage is above the configured threshold. If, not, the ICM waits a given amount of time (step 304 ) and then it determines the overall memory usage again. If the memory usage is above the global threshold, then the pruning process begins (step 306 ).
- FIG. 4 shows a flow diagram 400 of the basic ICM pruning process according to the present invention.
- Sessions within cache classes are selected for pruning by examining an ordered list of cache classes.
- the list consists first of those classes whose memory usage exceeds their threshold (step 402 ), in the order in which those classes appear on the configured list of cache classes; and then of those with usage below their threshold, in the order in which they appear on the configured list.
- the classes in that list are then examined, one at a time at step 404 . If removing all of the entries in a particular class would not bring total memory usage below the floor value, all entries in that class are selected for pruning (step 406 ), and the process continues (steps 408 , 410 ).
- step 412 if the floor can be reached by pruning only some fraction of the entries in that class—termed “selective pruning”—then that fraction of entries is identified for pruning (steps 412 , 414 ), and the process stops (step 416 ).
- the classes are examined until either it is determined that the floor value can be reached, or all entries within the defined cache classes have been selected for pruning.
- the ICM uses an algorithm that is both efficient and evenly distributive in its selection of entries to be pruned. Given some number b out of a total number of bytes t that must be freed, the brick approximates bit by dropping one low-order bit from both the numerator and denominator until either the numerator is reduced to 1 or the denominator becomes less than 256. As the brick examines the list of cache entries, it frees the first b out of every t entries in the given cache class. This is efficient because it avoids the use of floating-point arithmetic in determining when bit bytes have been freed. It is also well-distributed in the way it frees entries: The cache entries appear on the list in the order in which they were created, and thus the method of discarding entries is not biased toward the most- or least-recently created entries
- FIG. 5 shows a functional block diagram for the ICM system 500 of the present invention as it would be added to an existing packet processing system.
- the ICM system 500 works in connection with an existing stateful packet processing engine 502 which receives and transmits the inbound and outbound packets.
- the processing engine 502 couples to the session state cache 504 which in turn couple or connect to the new ICM processes 506 .
- a user configuration module 508 is coupled to the ICM processes 506 and is used to configure the ICM class definitions and the ICM thresholds, which are stored in an ICM classification and thresholds database 510 .
- the basic processes used by the ICM system include an ICM memory monitoring module 512 , an ICM cache classifier 514 and an ICM widespread prune selector 516 .
- the memory monitoring module 512 tracks overall cache memory usage.
- the cache classifier 514 tracks memory usage of each configured cache class and the prune selector 516 determines the sessions in the cache to purge, when necessary.
- an implementation of ICM must choose a set of criteria to use for configuring the ICM cache classes.
- the cache classifier is used to determine the class (or “category”) into which a given session falls. The criteria by which the classifier makes this decision is implementation-specific, but some common criteria can be suggested for TCP/IP-based sessions.
- OSI Layer 3 Information one or more of the following may be used for determining class: Source IP Address or Range, Destination IP Address or Range and IP Protocol (e.g. 6 for TCP, 17 for UDP).
- OSI Layer 4 Information TCP/UDP Source Port or Range, TCP/UDP Destination Port or Range (usually determines the server “application”) and whether or not the session is “fully-open” as defined by TCP state transitions can be used.
- Application-Specific Information whether or not the session is audited (i.e. “logged”), and to what degree of detail, whether the session is allowed or blocked (i.e. “passed” or “dropped”) and other application-specific information can be used to determine class.
- a SmartBits traffic generator was used to generate UDP packets with random source addresses and ports (in effect, each packet represented the start of a new session, from the brick's perspective).
- HTTP and FTP clients and servers were set up through the same Brick to simulate valid user traffic.
- ICM is designed to allow the firewall to continue processing traffic under massive denial of service attacks. Tunable parameters help the firewall administrator adjust the pruning thresholds more precisely to distinguish an attack from actual user traffic. ICM allows the firewall to continue to operate and process user traffic, even when flooded with extreme volumes of traffic.
- a significant advantage of the present invention is that it can be used in any stateful network entity to help it determine how to efficiently and effectively free resources that have been consumed by an attack.
- any element expressed as a means for performing a specified function is intended to encompass any way of performing that function including, for example, a) a combination of circuit elements which performs that function or b) software in any form, including, therefore, firmware, microcode or the like, combined with appropriate circuitry for executing that software to perform the function.
- the invention as defined by such claims resides in the fact that the functionalities provided by the various recited means are combined and brought together in the manner which the claims call for. Applicant thus regards any means which can provide those functionalities as equivalent as those shown herein. Many other modifications and applications of the principles of the invention will be apparent to those skilled in the art and are contemplated by the teachings herein. Accordingly, the scope of the invention is limited only by the claims appended hereto.
Abstract
Description
Claims (30)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US09/941,981 US7069588B2 (en) | 2001-08-29 | 2001-08-29 | System and method for protecting computer device against overload via network attack |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US09/941,981 US7069588B2 (en) | 2001-08-29 | 2001-08-29 | System and method for protecting computer device against overload via network attack |
Publications (2)
Publication Number | Publication Date |
---|---|
US20030046581A1 US20030046581A1 (en) | 2003-03-06 |
US7069588B2 true US7069588B2 (en) | 2006-06-27 |
Family
ID=25477402
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/941,981 Expired - Lifetime US7069588B2 (en) | 2001-08-29 | 2001-08-29 | System and method for protecting computer device against overload via network attack |
Country Status (1)
Country | Link |
---|---|
US (1) | US7069588B2 (en) |
Cited By (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020163925A1 (en) * | 2001-02-27 | 2002-11-07 | Aki Nakagawa | Data broadcast schedule system, and apparatus, method, recording medium or program thereabout |
US20030061514A1 (en) * | 2001-09-27 | 2003-03-27 | International Business Machines Corporation | Limiting the output of alerts generated by an intrusion detection sensor during a denial of service attack |
US20030079026A1 (en) * | 2001-09-11 | 2003-04-24 | Yoshikazu Watanabe | Information processing apparatus, information processing method, and program |
US20030229803A1 (en) * | 2002-06-11 | 2003-12-11 | Comer Erwin P. | Communication systems automated security detection based on protocol cause codes |
US20060015872A1 (en) * | 2004-07-13 | 2006-01-19 | Pohl William N | Process management |
US20060085854A1 (en) * | 2004-10-19 | 2006-04-20 | Agrawal Subhash C | Method and system for detecting intrusive anomalous use of a software system using multiple detection algorithms |
US20080040801A1 (en) * | 2004-11-29 | 2008-02-14 | Luca Buriano | Method and System for Managing Denial of Service Situations |
US20080205273A1 (en) * | 2007-02-26 | 2008-08-28 | Wackerly Shaun C | Network traffic monitoring |
US8413250B1 (en) | 2008-06-05 | 2013-04-02 | A9.Com, Inc. | Systems and methods of classifying sessions |
US20140281252A1 (en) * | 2013-03-15 | 2014-09-18 | Oracel International Corporation | Statement cache auto-tuning |
US10432650B2 (en) | 2016-03-31 | 2019-10-01 | Stuart Staniford | System and method to protect a webserver against application exploits and attacks |
US11627149B2 (en) * | 2017-01-27 | 2023-04-11 | Splunk Inc. | Security monitoring of network connections using metrics data |
Families Citing this family (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7469010B2 (en) * | 2001-01-08 | 2008-12-23 | Canon Kabushiki Kaisha | Extracting key frames from a video sequence |
US7316031B2 (en) * | 2002-09-06 | 2008-01-01 | Capital One Financial Corporation | System and method for remotely monitoring wireless networks |
US7792963B2 (en) * | 2003-09-04 | 2010-09-07 | Time Warner Cable, Inc. | Method to block unauthorized network traffic in a cable data network |
US7543052B1 (en) * | 2003-12-22 | 2009-06-02 | Packeteer, Inc. | Automatic network traffic discovery and classification mechanism including dynamic discovery thresholds |
US8203941B2 (en) * | 2004-05-28 | 2012-06-19 | Hewlett-Packard Development Company, L.P. | Virus/worm throttle threshold settings |
US7607170B2 (en) | 2004-12-22 | 2009-10-20 | Radware Ltd. | Stateful attack protection |
US20090018877A1 (en) * | 2007-07-10 | 2009-01-15 | Openconnect Systems Incorporated | System and Method for Modeling Business Processes |
US8155145B2 (en) * | 2008-03-28 | 2012-04-10 | Telefonaktiebolaget L M Ericsson (Publ) | Method and system for telecommunications using layer 3 packets obtained from a sequence of layer 2 radio link control layer data frames |
US8051136B2 (en) * | 2008-10-13 | 2011-11-01 | International Business Machines Corporation | Optimizing a presence enabled managed service |
US8392558B1 (en) | 2011-03-22 | 2013-03-05 | Amazon Technologies, Inc. | System and method for determining overload state for service requests |
US8380850B1 (en) | 2011-03-22 | 2013-02-19 | Amazon Technologies, Inc. | System and method for damping overload state oscillations |
US8429282B1 (en) | 2011-03-22 | 2013-04-23 | Amazon Technologies, Inc. | System and method for avoiding system overload by maintaining an ideal request rate |
US20120331227A1 (en) * | 2011-06-21 | 2012-12-27 | Ramakrishna Saripalli | Facilitating implementation, at least in part, of at least one cache management policy |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020065938A1 (en) * | 2000-06-23 | 2002-05-30 | Jungck Peder J. | Edge adapter architecture apparatus and method |
US20030110396A1 (en) * | 2001-05-03 | 2003-06-12 | Lewis Lundy M. | Method and apparatus for predicting and preventing attacks in communications networks |
-
2001
- 2001-08-29 US US09/941,981 patent/US7069588B2/en not_active Expired - Lifetime
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020065938A1 (en) * | 2000-06-23 | 2002-05-30 | Jungck Peder J. | Edge adapter architecture apparatus and method |
US20030110396A1 (en) * | 2001-05-03 | 2003-06-12 | Lewis Lundy M. | Method and apparatus for predicting and preventing attacks in communications networks |
Cited By (22)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020163925A1 (en) * | 2001-02-27 | 2002-11-07 | Aki Nakagawa | Data broadcast schedule system, and apparatus, method, recording medium or program thereabout |
US20030079026A1 (en) * | 2001-09-11 | 2003-04-24 | Yoshikazu Watanabe | Information processing apparatus, information processing method, and program |
US7346692B2 (en) * | 2001-09-11 | 2008-03-18 | Sony Corporation | Information processing apparatus, information processing method, and program |
US7308714B2 (en) * | 2001-09-27 | 2007-12-11 | International Business Machines Corporation | Limiting the output of alerts generated by an intrusion detection sensor during a denial of service attack |
US20030061514A1 (en) * | 2001-09-27 | 2003-03-27 | International Business Machines Corporation | Limiting the output of alerts generated by an intrusion detection sensor during a denial of service attack |
US7730537B2 (en) | 2001-09-27 | 2010-06-01 | International Business Machines Corporation | Method of operating an intrusion detection system |
US20030229803A1 (en) * | 2002-06-11 | 2003-12-11 | Comer Erwin P. | Communication systems automated security detection based on protocol cause codes |
US7367055B2 (en) * | 2002-06-11 | 2008-04-29 | Motorola, Inc. | Communication systems automated security detection based on protocol cause codes |
US20060015872A1 (en) * | 2004-07-13 | 2006-01-19 | Pohl William N | Process management |
US20060085854A1 (en) * | 2004-10-19 | 2006-04-20 | Agrawal Subhash C | Method and system for detecting intrusive anomalous use of a software system using multiple detection algorithms |
US8108929B2 (en) * | 2004-10-19 | 2012-01-31 | Reflex Systems, LLC | Method and system for detecting intrusive anomalous use of a software system using multiple detection algorithms |
US20080040801A1 (en) * | 2004-11-29 | 2008-02-14 | Luca Buriano | Method and System for Managing Denial of Service Situations |
US8356350B2 (en) * | 2004-11-29 | 2013-01-15 | Telecom Italia S.P.A. | Method and system for managing denial of service situations |
US20080205273A1 (en) * | 2007-02-26 | 2008-08-28 | Wackerly Shaun C | Network traffic monitoring |
US7924720B2 (en) | 2007-02-26 | 2011-04-12 | Hewlett-Packard Development Company, L.P. | Network traffic monitoring |
US8413250B1 (en) | 2008-06-05 | 2013-04-02 | A9.Com, Inc. | Systems and methods of classifying sessions |
US9288124B1 (en) | 2008-06-05 | 2016-03-15 | A9.Com, Inc. | Systems and methods of classifying sessions |
US9699042B2 (en) | 2008-06-05 | 2017-07-04 | A9.Com, Inc. | Systems and methods of classifying sessions |
US20140281252A1 (en) * | 2013-03-15 | 2014-09-18 | Oracel International Corporation | Statement cache auto-tuning |
US10642735B2 (en) * | 2013-03-15 | 2020-05-05 | Oracle International Corporation | Statement cache auto-tuning |
US10432650B2 (en) | 2016-03-31 | 2019-10-01 | Stuart Staniford | System and method to protect a webserver against application exploits and attacks |
US11627149B2 (en) * | 2017-01-27 | 2023-04-11 | Splunk Inc. | Security monitoring of network connections using metrics data |
Also Published As
Publication number | Publication date |
---|---|
US20030046581A1 (en) | 2003-03-06 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7069588B2 (en) | System and method for protecting computer device against overload via network attack | |
US7436770B2 (en) | Metering packet flows for limiting effects of denial of service attacks | |
US7054930B1 (en) | System and method for propagating filters | |
US8325607B2 (en) | Rate controlling of packets destined for the route processor | |
US7215637B1 (en) | Systems and methods for processing packets | |
US7580351B2 (en) | Dynamically controlling the rate and internal priority of packets destined for the control plane of a routing device | |
EP1737189B1 (en) | Apparatus and method for mitigating denial of service attacks on communication appliances | |
US8509106B2 (en) | Techniques for preventing attacks on computer systems and networks | |
US11539664B2 (en) | Methods and systems for efficient adaptive logging of cyber threat incidents | |
JP2010268483A (en) | Active network defense system and method | |
JP2006517066A (en) | Mitigating denial of service attacks | |
US8910267B2 (en) | Method for managing connections in firewalls | |
Dang et al. | Sdn-based syn proxy—a solution to enhance performance of attack mitigation under tcp syn flood | |
Dang-Van et al. | A multi-criteria based software defined networking system Architecture for DDoS-attack mitigation | |
US9455953B2 (en) | Router chip and method of selectively blocking network traffic in a router chip | |
Wang et al. | Transport-aware IP routers: A built-in protection mechanism to counter DDoS attacks | |
Arafat et al. | A practical approach and mitigation techniques on application layer DDoS attack in web server | |
EP2109282B1 (en) | Method and system for mitigation of distributed denial of service attacks based on IP neighbourhood density estimation | |
WO2004070547A2 (en) | Method and device for monitoring data traffic and preventing unauthorized access to a network | |
KR20030009887A (en) | A system and method for intercepting DoS attack | |
Chen | Aegis: An active-network-powered defense mechanism against ddos attacks | |
Trabelsi et al. | Resilence of network stateful firewalls against emerging DoS attacks: A case study of the blacknurse attack | |
EP2109279B1 (en) | Method and system for mitigation of distributed denial of service attacks using geographical source and time information | |
KR101465462B1 (en) | Method and system for controlling a computer application program | |
Fan et al. | Proactively defeating distributed denial of service attacks |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: LUCENT TECHNOLOGIES, INC., NEW JERSEY Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CALL, R. CHRISTIAN;CAVUTO, DAVID J.;GIORGIS, TADESSE W.;REEL/FRAME:012159/0103 Effective date: 20010827 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
FEPP | Fee payment procedure |
Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
FPAY | Fee payment |
Year of fee payment: 4 |
|
AS | Assignment |
Owner name: CREDIT SUISSE AG, NEW YORK Free format text: SECURITY INTEREST;ASSIGNOR:ALCATEL-LUCENT USA INC.;REEL/FRAME:030510/0627 Effective date: 20130130 |
|
FEPP | Fee payment procedure |
Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Free format text: PAYER NUMBER DE-ASSIGNED (ORIGINAL EVENT CODE: RMPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
FPAY | Fee payment |
Year of fee payment: 8 |
|
AS | Assignment |
Owner name: SOUND VIEW INNOVATIONS, LLC, NEW JERSEY Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ALCATEL LUCENT;REEL/FRAME:032086/0016 Effective date: 20131223 |
|
AS | Assignment |
Owner name: ALCATEL-LUCENT USA INC., NEW JERSEY Free format text: RELEASE OF SECURITY INTEREST;ASSIGNOR:CREDIT SUISSE AG;REEL/FRAME:032537/0133 Effective date: 20131223 |
|
AS | Assignment |
Owner name: ALCATEL-LUCENT USA INC., NEW JERSEY Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:CREDIT SUISSE AG;REEL/FRAME:033949/0531 Effective date: 20140819 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1553) Year of fee payment: 12 |
|
AS | Assignment |
Owner name: ALCATEL-LUCENT USA INC., NEW JERSEY Free format text: MERGER AND CHANGE OF NAME;ASSIGNORS:ALCATEL USA MARKETING, INC.;ALCATEL USA SOURCING, INC.;LUCENT TECHNOLOGIES, INC.;AND OTHERS;REEL/FRAME:050460/0510 Effective date: 20081017 |
|
AS | Assignment |
Owner name: NOKIA OF AMERICA CORPORATION, DELAWARE Free format text: CHANGE OF NAME;ASSIGNOR:ALCATEL-LUCENT USA INC.;REEL/FRAME:050476/0085 Effective date: 20180103 |
|
AS | Assignment |
Owner name: ALCATEL LUCENT, FRANCE Free format text: NUNC PRO TUNC ASSIGNMENT;ASSIGNOR:NOKIA OF AMERICA CORPORATION;REEL/FRAME:050662/0204 Effective date: 20190927 |